全部产品
Search
文档中心

访问控制:AliyunCSDefaultRolePolicy

更新时间:Nov 29, 2024

AliyunCSDefaultRolePolicy 是专用于服务角色的授权策略,通常会在创建对应的服务角色时同步完成授权,以允许服务角色代您访问其他云服务。本策略由对应的阿里云服务按需更新,请勿将本策略授权给服务角色之外的 RAM 身份使用。

策略详情

  • 类型:系统策略

  • 创建时间:2024-10-18 11:12:59

  • 更新时间:2024-10-18 11:12:59

  • 当前版本:v1

策略内容

{
	"Version": "1",
	"Statement": [{
			"Action": [
				"arms:CreateOrUpdateWebhookContact",
				"arms:DeleteWebhookContact",
				"arms:DescribeWebhookContacts",
				"arms:CreateOrUpdateIMRobot",
				"arms:DeleteIMRobot",
				"arms:DescribeIMRobots",
				"arms:SendTTSVerifyLink",
				"arms:SaveContactMember",
				"arms:UpdateContactMember",
				"arms:DeleteContactMember",
				"arms:SaveContactGroup",
				"arms:UpdateContactGroup",
				"arms:DeleteContactGroup",
				"arms:DeleteContactLink",
				"arms:GetAlertRulesByPage",
				"arms:QueryAlarmHistory",
				"arms:QueryAlarmName",
				"arms:GetAlertEvents",
				"arms:SearchEvents",
				"arms:SearchAlarmHistories",
				"arms:GetAlarmHistories",
				"arms:CreateContact",
				"arms:DeleteContact",
				"arms:DeleteAlertContact",
				"arms:SearchContact",
				"arms:UpdateContact",
				"arms:CreateContactGroup",
				"arms:DeleteContactGroup",
				"arms:DeleteAlertContactGroup",
				"arms:SearchContactGroup",
				"arms:UpdateContactGroup",
				"arms:GetAlert",
				"arms:DeleteGrafanaResource",
				"arms:ListDashboards",
				"arms:ListDispatchRule",
				"arms:CreateDispatchRule",
				"arms:DeleteDispatchRule",
				"arms:DescribeDispatchRule",
				"arms:UninstallManagedPrometheus",
				"arms:InnerFetchContactByArmsContactId",
				"arms:ListAlertContact",
				"arms:SearchAlertContactGroup",
				"arms:CreateAlertContactGroup",
				"arms:UpdateAlertContactGroup",
				"arms:UpdateDispatchRule"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ecs:RunInstances",
				"ecs:RenewInstance",
				"ecs:Create*",
				"ecs:AllocatePublicIpAddress",
				"ecs:AllocateEipAddress",
				"ecs:Delete*",
				"ecs:StartInstance",
				"ecs:StopInstance",
				"ecs:RebootInstance",
				"ecs:Describe*",
				"ecs:AuthorizeSecurityGroup",
				"ecs:RevokeSecurityGroup",
				"ecs:AuthorizeSecurityGroupEgress",
				"ecs:AttachDisk",
				"ecs:DetachDisk",
				"ecs:WaitFor*",
				"ecs:AddTags",
				"ecs:ReplaceSystemDisk",
				"ecs:ModifyInstanceAttribute",
				"ecs:JoinSecurityGroup",
				"ecs:LeaveSecurityGroup",
				"ecs:UnassociateEipAddress",
				"ecs:ReleaseEipAddress",
				"ecs:CreateKeyPair",
				"ecs:ImportKeyPair",
				"ecs:AttachKeyPair",
				"ecs:DetachKeyPair",
				"ecs:DeleteKeyPairs",
				"ecs:AttachInstanceRamRole",
				"ecs:DetachInstanceRamRole",
				"ecs:AllocateDedicatedHosts",
				"ecs:CreateOrder",
				"ecs:DeleteInstance",
				"ecs:CreateDisk",
				"ecs:Createvpc",
				"ecs:Deletevpc",
				"ecs:DeleteVSwitch",
				"ecs:ResetDisk",
				"ecs:DeleteSnapshot",
				"ecs:AllocatePublicIpAddress",
				"ecs:CreateVSwitch",
				"ecs:DeleteSecurityGroup",
				"ecs:CreateImage",
				"ecs:RemoveTags",
				"ecs:ReleaseDedicatedHost",
				"ecs:CreateInstance",
				"ecs:RevokeSecurityGroupEgress",
				"ecs:DeleteDisk",
				"ecs:StopInstance",
				"ecs:CreateSecurityGroup",
				"ecs:DeleteImage",
				"ecs:ModifyInstanceSpec",
				"ecs:CreateSnapshot",
				"ecs:CreateCommand",
				"ecs:InvokeCommand",
				"ecs:StopInvocation",
				"ecs:DeleteCommand",
				"ecs:RunCommand",
				"ecs:DescribeInvocationResults",
				"ecs:TagResources",
				"ecs:UntagResources",
				"ecs:ModifyCommand"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"vpc:Describe*",
				"vpc:AllocateEipAddress",
				"vpc:AssociateEipAddress",
				"vpc:UnassociateEipAddress",
				"vpc:ReleaseEipAddress",
				"vpc:CreateRouteEntry",
				"vpc:DeleteRouteEntry",
				"vpc:CreateVSwitch",
				"vpc:DeleteVSwitch",
				"vpc:CreateVpc",
				"vpc:DeleteVpc",
				"vpc:CreateNatGateway",
				"vpc:DeleteNatGateway",
				"vpc:CreateSnatEntry",
				"vpc:DeleteSnatEntry",
				"vpc:ModifyEipAddressAttribute",
				"vpc:CreateForwardEntry",
				"vpc:DeleteBandwidthPackage",
				"vpc:CreateBandwidthPackage",
				"vpc:DeleteForwardEntry",
				"vpc:TagResources",
				"vpc:ListEnhanhcedNatGatewayAvailableZones",
				"vpc:DeletionProtection"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"slb:Describe*",
				"slb:CreateLoadBalancer",
				"slb:DeleteLoadBalancer",
				"slb:RemoveBackendServers",
				"slb:StartLoadBalancerListener",
				"slb:StopLoadBalancerListener",
				"slb:CreateLoadBalancerTCPListener",
				"slb:AddBackendServers*",
				"slb:CreateVServerGroup",
				"slb:CreateLoadBalancerHTTPSListener",
				"slb:CreateLoadBalancerUDPListener",
				"slb:ModifyLoadBalancerInternetSpec",
				"slb:SetBackendServers",
				"slb:AddVServerGroupBackendServers",
				"slb:DeleteVServerGroup",
				"slb:ModifyVServerGroupBackendServers",
				"slb:CreateLoadBalancerHTTPListener",
				"slb:RemoveVServerGroupBackendServers",
				"slb:DeleteLoadBalancerListener",
				"slb:AddTags",
				"slb:RemoveTags",
				"slb:SetLoadBalancerDeleteProtection",
				"slb:SetLoadBalancerTCPListenerAttribute",
				"slb:CreateAccessControlList",
				"slb:DescribeAccessControlLists",
				"slb:AddAccessControlListEntry",
				"slb:SetLoadBalancerModificationProtection"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"dns:Describe*",
				"dns:AddDomainRecord"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"nlb:GetLoadBalancerAttribute",
				"nlb:ListListeners"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"rds:Describe*",
				"rds:ModifySecurityIps",
				"rds:ModifySecurityGroupConfiguration"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"ros:Describe*",
				"ros:WaitConditions",
				"ros:AbandonStack",
				"ros:DeleteStack",
				"ros:CreateStack",
				"ros:UpdateStack",
				"ros:ValidateTemplate",
				"ros:DoActions",
				"ros:InquiryStack",
				"ros:SetDeletionProtection",
				"ros:PreviewStack",
				"ros:GetStack",
				"ros:ListStackResources",
				"ros:GetStackResource",
				"ros:TagResources",
				"ros:ListStackOperationRisks"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": "ram:PassRole",
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ess:Describe*",
				"ess:CreateScalingConfiguration",
				"ess:EnableScalingGroup",
				"ess:ExitStandby",
				"ess:DetachDBInstances",
				"ess:DetachLoadBalancers",
				"ess:AttachInstances",
				"ess:DeleteScalingConfiguration",
				"ess:AttachLoadBalancers",
				"ess:DetachInstances",
				"ess:ModifyScalingRule",
				"ess:RemoveInstances",
				"ess:ModifyScalingGroup",
				"ess:AttachDBInstances",
				"ess:CreateScalingRule",
				"ess:DeleteScalingRule",
				"ess:ExecuteScalingRule",
				"ess:SetInstancesProtection",
				"ess:ModifyNotificationConfiguration",
				"ess:CreateNotificationConfiguration",
				"ess:EnterStandby",
				"ess:DeleteScalingGroup",
				"ess:CreateScalingGroup",
				"ess:DisableScalingGroup",
				"ess:DeleteNotificationConfiguration",
				"ess:ModifyScalingConfiguration",
				"ess:ReplaceSystemDisk",
				"ess:ScaleWithAdjustment",
				"ess:SetGroupDeletionProtection"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:Get*",
				"ram:List*"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:DetachPolicyFromRole",
				"ram:AttachPolicyToRole",
				"ram:DeletePolicy",
				"ram:DeletePolicyVersion",
				"ram:DeleteRole"
			],
			"Resource": [
				"acs:ram:*:*:role/KubernetesMasterRole-*",
				"acs:ram:*:*:role/KubernetesWorkerRole-*",
				"acs:ram:*:*:policy/k8sMasterRolePolicy-*",
				"acs:ram:*:*:policy/k8sWorkerRolePolicy-*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:CreateRole",
				"ram:CreatePolicy"
			],
			"Resource": [
				"acs:ram:*:*:role/*",
				"acs:ram:*:*:policy/*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:CreateOIDCProvider",
				"ram:GetOIDCProvider",
				"ram:UpdateOIDCProvider",
				"ram:DeleteOIDCProvider"
			],
			"Effect": "Allow",
			"Resource": "*",
			"Condition": {
				"StringLike": {
					"ram:OidcIssuerUrl": [
						"https://oidc-ack-*.aliyuncs.com/*"
					]
				}
			}
		},
		{
			"Action": [
				"cms:CreateMyGroups",
				"cms:AddMyGroupInstances",
				"cms:DeleteMyGroupInstances",
				"cms:DeleteMyGroups",
				"cms:GetMyGroups",
				"cms:ListMyGroups",
				"cms:UpdateMyGroupInstances",
				"cms:UpdateMyGroups",
				"cms:TaskConfigCreate",
				"cms:TaskConfigList",
				"cms:DescribeMetricData",
				"cms:DescribeMetricLast",
				"cms:DescribeMetricMetaList",
				"cms:DescribeMetricTop",
				"cms:QueryMetricMeta",
				"cms:QueryMetricTop",
				"cms:ListMetricMeta",
				"cms:ListMetricMetaProject",
				"cms:QueryMetricData",
				"cms:QueryMetricLast",
				"cms:DescribeMetricList",
				"cms:QueryMetricList",
				"cms:MetricMeta",
				"cms:PutMonitoringConfig",
				"cms:DescribeContactList",
				"cms:PutContact",
				"cms:PutContactGroup",
				"cms:DeleteContact",
				"cms:DeleteContactGroup",
				"cms:DescribeAlertLogList",
				"cms:DescribeSystemEventAttribute",
				"cms:GetMetricStreamMeta"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ess:CreateLifecycleHook",
				"ess:DescribeLifecycleHooks",
				"ess:ModifyLifecycleHook",
				"ess:DeleteLifecycleHook"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Effect": "Allow",
			"Action": [
				"cen:AttachCenChildInstance",
				"cen:DetachCenChildInstance",
				"cen:DescribeCenAttachedChildInstances",
				"cen:DescribeCens"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"netana:DescribeNetworkQuotas"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"smartag:DescribeCloudConnectNetworks"
			],
			"Resource": "*"
		},
		{
			"Action": [
				"ens:Describe*",
				"ens:CreateInstance",
				"ens:StartInstance",
				"ens:StopInstance",
				"ens:ReleasePrePaidInstance"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"bms:ListInstance",
				"bms:ListInstanceOverview"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"kvstore:RegistACKCluster",
				"kvstore:UnRegistACKCluster"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"eci:DescribeContainerGroups",
				"eci:DeleteContainerGroup",
				"eci:RunCommand",
				"eci:DescribeCommandResult"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"acc:DescribeInstances",
				"acc:DeleteInstance"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"cs:DescribeClusterDetail",
				"cs:DescribeClusterResources",
				"cs:DescribeTasks",
				"cs:DescribeTaskInfo",
				"cs:DescribeClusterNodePools",
				"cs:DescribeNodePoolVuls",
				"cs:ScanClusterVuls",
				"cs:FixNodePoolVuls",
				"cs:PauseTask",
				"cs:ResumeTask",
				"cs:CancelTask",
				"cs:InstallClusterAddons",
				"cs:UnInstallClusterAddons",
				"cs:UpgradeClusterAddons",
				"cs:DescribeClusterAddonsVersion",
				"cs:UpgradeCluster",
				"cs:ModifyCluster",
				"cs:ListClusterAddonInstances",
				"cs:GetClusters",
				"cs:UpgradeClusterNodepool",
				"cs:ModifyClusterNodePool",
				"cs:DescribeClusterNodes",
				"cs:DescribeKubernetesVersionMetadata",
				"cs:GetClusterCheck",
				"cs:RunClusterCheck",
				"cs:ListAddons",
				"cs:DescribeClusterAddonsUpgradeStatus"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"log:CreateResourceRecord",
				"log:UpdateResourceRecord",
				"log:UpsertResourceRecord",
				"log:GetResourceRecord",
				"log:ListResourceRecords",
				"log:ListResources",
				"log:GetResource",
				"log:CreateLogStore",
				"log:CreateIndex",
				"log:UpdateIndex",
				"log:CreateDashboard",
				"log:UpdateDashboard",
				"log:CreateProject",
				"log:DeleteProject",
				"log:GetLogStoreLogs",
				"log:PostLogStoreLogs",
				"log:GetLogStore",
				"log:UpdateLogStore",
				"log:DeleteResourceRecord"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"mscsub:ListContacts"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"quotas:ListProducts",
				"quotas:ListProductQuotas",
				"quotas:ListProductQuotas",
				"quotas:ListProductQuotaDimensions",
				"quotas:GetProductQuota",
				"quotas:GetProductQuotaDimension"
			],
			"Resource": "acs:quotas:*:*:*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"nas:DescribeFileSystems",
				"nas:DescribeMountTargets",
				"nas:CreateFileSystem",
				"nas:TagResources",
				"nas:EnableRecycleBin",
				"nas:CreateMountTarget"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Effect": "Allow",
			"Action": [
				"yundun-sas:DescribeVulList",
				"yundun-sas:DescribeVersionConfig",
				"yundun-sas:ModifyOperateVul",
				"yundun-sas:DescribeVersionConfig",
				"yundun-sas:DescribeGroupedContainerInstances",
				"yundun-sas:DescribeSuspEvents"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"cr:ListCloudProductAuth",
				"cr:CreateClusterImageAnalysisTask",
				"cr:GetClusterImageAnalysisTask"
			],
			"Resource": "*"
		},
		{
			"Action": [
				"oos:StartExecution",
				"oos:ListExecutions"
			],
			"Resource": [
				"acs:oos:*:*:template/ACS-CS-DedicatedMigration",
				"acs:oos:*:*:execution/*"
			],
			"Effect": "Allow"
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": [
						"ess.aliyuncs.com",
						"nat.aliyuncs.com"
					]
				}
			}
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "eipaccess.slb.aliyuncs.com"
				}
			}
		},
		{
			"Action": "ram:CreateServiceLinkedRole",
			"Resource": "*",
			"Effect": "Allow",
			"Condition": {
				"StringEquals": {
					"ram:ServiceName": "systemeventoperator.oos.aliyuncs.com"
				}
			}
		}
	]
}

相关文档